SAML2 authentication issue with user ID cases

[former_member217468]

Hi All, we are trying to achieve SSO with SAML auth between our portal and Ariba , the issue we are facing is the user ID's in LDAP are in lower case and the User ID's in Ariba is in upper case and thus the SAML authentication fails , is there any way in which the SAML2 can ignore cases .

Thank you

Jonu Joy

[former_member182254]

Hi Jonu,

If the Ariba system could be configured to ignore cases is something that the Ariba colleagues should answer. However I do not think they monitor the questions in the SSO community here.

That's why I will try to provide you information what is possible to be configured at the IDP (Portal) side. If you deploy SSOAUTHLIB component from SSO product you will get some IDP extensions which will allow you to define server side JavaScript policies:

- Assertion policy: it is called before an assertion is to be issued and can deny the issuing of an assertion but also perform some other operations

- Attribute policy: it is called in order to define what additional attributes should to be added into the SAML assertion

In the SAML assertion you have a Subject NameID which normally contains the user id and an additional section (AttributeStatement) which contain so called assertion attributes. In certain cases the Subject NameID is not matching the user id in the service provider system and some of the attributes should be used to do the mapping, for example email, SSN, etc. If the Ariba system allows you to configure login based on an assertion attribute then the easiest way to implement your scenario would be to write a simple policy script which converts the user id into upper case and set it as an assertion attribute. Please check if this is possible and I could provide you further instructions how to do this.

Best regards,

Dimitar Mihaylov